8689444c973c5ef81c372fce472228c51eb7cb247209ea6d7f304dde1e486a48

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

516397e4d516e0ec1d6943ddd8656150N.exe
Size

84KB
MD5

516397e4d516e0ec1d6943ddd8656150
SHA1

87dd469a1122a1eb358b647eb9fe30dee7a87fca
SHA256

8689444c973c5ef81c372fce472228c51eb7cb247209ea6d7f304dde1e486a48
SHA512

73335b7f88dbe846bcf3d07148f561c18f2c852e15ef71d25ac4c8359f75b980c2e3ef172289f0779d11d89cc58acc4e8dc97c6c95b32ef4ac5469bda829e334
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eTdsdYSWFYcUYcN:6e7WpMaxeb0CYJ97lEYNR73e+eBSWs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\ExportSelect.ico.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	516397e4d516e0ec1d6943ddd8656150N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	516397e4d516e0ec1d6943ddd8656150N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	516397e4d516e0ec1d6943ddd8656150N.exe

C:\Users\Admin\AppData\Local\Temp\516397e4d516e0ec1d6943ddd8656150N.exe
"C:\Users\Admin\AppData\Local\Temp\516397e4d516e0ec1d6943ddd8656150N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
85KB

MD5
83b981b1c3c187c54a9fcb6c394ece7f

SHA1
ab303f6ffaa7bb92eafad481d6a8a97d3d45aa76

SHA256
d886df1b2f600547e87ceee7cc1ce8681e0074b120a7fcab812cae079f9531c0

SHA512
205ffa684925d38b56b5927bd076109acb276b66fca6fa7bd8fd8658e61c062fd035e57cc5b5dd42e1e3a1de918e4e08b264b654f3ced8be93424127ada9e381

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
3dc84b90a6f710c66c386e3350e5791c

SHA1
98e60efb3330e2f30ef7988c83684924a88afba8

SHA256
d0c0d78f311098a298e5802e7d55520d9874528c60bd93b7e9acb7f0b4ab350e

SHA512
945a0b328665a0cbdea228539095a5eece9556d6bf6a1613f89c21acd6a2fed22bfe9f30f06038c940b37ae7f50facbeffc546b6ca575566c360736c29fa8980

Download Submit